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Outline 



• Cyber COI Overview 
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BLUF - Bottom Line Up Front 



* Established, mature, and coordinated community 

* Cyber S&T aligned to expanding operational 
capability gaps/priorities 

* Cyber S&T contributions to nearly all Seven DoD 
Hard Problems 

* Driving deeper engagement with industry and 
international partners 
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S&T Influencing the DoD Cyber 

Landscape 


“...we will continue to invest in capabilities critical to future success, including... operating in anti¬ 
access environments; and prevailing in all domains, including cyber.” 

- President Obama, January 2012 
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DoD Cyber S&T Coordination 




DISA NSA DCIO ONR/ AFRL/ NSA DARPA RDECOM DTRA USSTRATCOM/ USD(I) 

IAD NRL AFOSR Research USCYBERCOM 


Community of Interest and Working Groups are the primary means for oversight, collaboration, & coordination 
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Cyber COI - Scope 




Cyber COI 

4+2 Taxonomy 


Autonomy 


Communitie 


An Operational Domain: JS OV-5a. Based on JROC- 

Approved Capability Documents and DoD CIO- 

developed Architectures 

- Spans Defense, Effects, 

Situational Awareness-Course of 
Action 

- Includes enterprise, tactical and 
embedded 

- Cuts across all domains 

- Touches C4I, EW, Autonomy, and 
Human Systems COIs 

- Transcends S&T across all 
DOTMLPF 

- QDR Tenets Addressed 

• Mitigates Threats 

• Delivers Affordable Capability 

• Affords Technological Surprise 
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Joint Staff OV-5a 


Mission Concepts 


^ Cyber S&T ^ 
Mission Capabilities 
Framework ^ 
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Defense 




Offense 
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DoD Cyber S&T: Performers 

(FY14 Execution) 

• Service S&T Labs 

- AFRL, RDECOM, NRL, SPAWAR 

• DoD Agencies 

• DoE Labs 

• FFRDCs 

• Industry 

• Academia 
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Cyber COI Recent Activities 


• (U) Briefed roadmap to S&T EXCOM in 
May 

- (U) Cyber PSC -> Cyber [Security] COI 

- (U) Incorporated findings of Cyber Investment 
Management Board 

- (U) High-level cyber S&T metrics 


• Evolving toward a Level 4 COI 

- (U) International: Working multilateral cyber 
S&T agreements 

- (U) Academic: HBCU-MI Cyber Center of 
Excellence 

- (U) Industry: Engagement and collaboration 
leading to strategic Reliance 


- Circa 2009 - 

0 Cyber Security COI Taxonomy O 


Cyber Situational Awareness 


Security of Embedded and 


Weapons Systems 


Cyber Maneuver 

1 

Recovery and Reconstitution 

1 

Secure Mobility 


Science of Cyber Security 



_ TODAY 

Cyber COI S&T Technology Areas 

COI Roadmaps Now Address FuM-Spectrum Cyber Operations 


• Foundations 

- Cyt>er PSC Roadmap 

- Joint Staff OV-5a 

- Cyder S&T Capability 
Framework 

- COCOM OPLANS 

- Cyber Forces Concept of 
Employment 

- RDT&E Needs 


T&r 
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Outline 



• BLUF 

• Cyber COI Overview 

• Roadmap Development Process 

• Cyber COI “4 + 2” S&T Roadmaps and Recent 
Successes 

• Hard Problems and Gaps 

• Engagements, Way Ahead, and Opportunities 

• Summary 
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Cyber S&T Roadmap Evolution 



Technology 

Challenges 



CIMB Driven Developments 


Cyber S&T 
Capability 
Framework 


COI 


Way Ahead: CIMB & 
Cyber Metrics Maturation 


GOF Study 4.18 
DoD S&T 
Investment in 
Cyberspace Security 
and Information 
Assurance 




Cyber Forces Concept 
of Employment 


csa 




Roadmap 
Development and 
Priority Gaps 


Cyber Col 
14-NOV-14 Page-10 


Distribution A - For Public Release 




































Cyber S&T Capability Framework 

From CIMB Analysis of JS OV-5 



Defense 


r 


>- 


Reduce attack surface and 
increase resiliency of DODIN 


< 


y 


Reduce attack surface and 
increase resiliency of 
embedded/weapons systems 


< 


Discover, understand, and 
engage threats 


Engagement 



Respond to large-scale threats 


Situational Awareness and Courses of Action 


Cyberspace situational 
awareness 



Understand cyber 
dependencies of 
missions 


Integrated course of 
action, cyber and non- 
cyber 
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Cyber S&T Capability Framework 

Examples of High Level Metrics 


Defense Engagement 

• Increase total resources required 
by an adversary to achieve an 
effect 

• Reduce adversary dwell time 

• Reduce time until defense forces 
are aware of adversary 


Situational Awareness and Courses of Action 

• Reduce time to map mission dependencies on cyber assets 

• Improve robustness of mission-to-cyber mapping 

• Increase quality of generated COA's 


Increase cyber readiness 

Increase sophistication of campaign 

plans 
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Cyber S&T Roadmap 

Technology Challenges & Cross Cutting Areas 
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DoD’s Joint Cyber S&T Focus Areas 


r 


"N 


Assuring 

Effective Missions 


/ - 

Agile 

Operations 

v_ 

/- 

Resilient 

Infrastructure 


Assess & control the cyber situation in mission context 


_/ 

-\ 

Escape harm by dynamically reshaping cyber systems as 
conditions/goals change 

_> 

-\ 

Withstand cyber attacks, while sustaining or recovering critical functions 


\_/ 


r 

Trust 

Establish known degree of assurance that devices, networks, 
and cyber-dependent functions perform as expected, despite 

A 

^- 

attack or error 







Embedded, Mobile, Increase the capability of cyber systems that rely on technologies 

& Tactical (EMT) beyond wired networking and standard computing platforms 


Modeling, Simulation, 

& Experimentation (MSE) 


Simulate the cyber environment in which the DoD operates to enable 
mission rehearsal and a more robust assessment and validation of 
cyber technology development 
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O 
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Outline 



• BLUF 

• Cyber COI Overview 

• Roadmap Development Process 

• Cyber COI “4 + 2” S&T Roadmaps and Recent 
Successes 

• Hard Problems and Gaps 

• Engagements, Way Ahead, and Opportunities 

• Summary 
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Cyber FY15 S&T Across 4+2 
Technology Areas 


Funding Observations 

- Appropriately increasing 
emphasis in AEM and EMT 

- Continued strong demand for 
Resilience 

- Trust focuses on military-unique 
topics 

- Agility operational goals and 
tradeoffs under discussion 

- Under-investment in MS&E 
resulting in acquisition and 
operational gaps 


Breakout of FY 15 Cyber Investment 
Across 4+2 Taxonomy (%) 



*Note: The EMT figures include some overlap with the other technology areas. 
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Trust Foundations 

Objectives /Accomplishments / Challenges 


Objectives: 

• Trusted Components and Architectures: Develop 
measures of trustworthiness for cyber components 
and large systems of varying pedigree and 
trustworthiness 

• Scalable Supply Chain Analysis and Reverse 
Engineering: Analyze, attribute, and repurpose 
hardware and software at the speed and scale 
required for real-time strategic engagement 



Accomplishments: 


Technical Challenges : 


• FY13/14 Success Stories 

- Army: SW Assurance Toolkit (SWAT) 

- AF: Secure Processor 

- AF: Context/Content Aware Trusted Router 

- AF: Secure View 


• Development of Trust Anchors for component-level 
and composed HW and SW 

• Tamper-proof/evident HW and SW components 
and systems 

• Contextual threat/trust scoring calculus 


• Rapid, assisted, and automated HW and SW 
analysis and validation 


• Algorithms for accurate attribution of malware 
authors and supply chain tampering 
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Trust Foundations Roadmap 
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Resilient Infrastructure 

Objectives /Accomplishments / Challenges 


Objectives: 

• Resilient Architectures: Develop integrated 
architectures that are optimized for the ability to 
absorb shock and speed recovery to a known 
secure operable state. 

• Resilient Algorithms and Protocols: Develop 
novel protocols and algorithms to increase the 
repertoire of resiliency mechanisms available to the 
architecture that are orthogonal to cyber threats. 


Accomplishments : 

• FY13/14 

- Army DEFIANT 

- Army: CRUSHPROOF 



Technical Challenges : 

• Assessment environments and tools for measuring 
resiliency of HW, SW, networks, and systems 

• Calculus for relating resiliency concepts into 
measurable operational impact and automated 
DODIN defense actions 

• Resilient overlay control planes that orchestrate 
defense of heterogeneous DODIN systems 

• Secure, LPI/J, energy-efficient, mobile 
communication protocols 

• Certifiable, agile, and affordable mobile device HW, 
OS, and app ecosystem 
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Resilient Infrastructure Roadmap 
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Agile Operations 

Objectives /Accomplishments / Challenges 



Objectives: 

• Cyber Maneuver: Develop mechanisms that 
enable dynamically changing cyber assets to be 
marshaled and directed toward an objective - to 
create or maintain a defensive or offensive 
advantage 

• Autonomic Cyber Agility: Speed the ability to 
reconfigure, heal, optimize, and protect cyber 
mechanisms via automated sensing and control 
processes 


AccompMshments : 
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Hopping 
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Cyber 
Maneuver 
Feedback & 
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Services 


Technical Challenges : 


• Army: MorphiNator 

• AF: ARCSYNE/COSYNE 


• Real-time, mission-aware traffic engineering 
including routing of threats 

• Collaborative, coordinated cyber maneuver of 
multiple actors and forces (including coalition) 

• Cyber maneuver for deceiving threats 

• Dynamic reconfiguration of networks, systems and 
applications 


• Autonomous reconfiguration 
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Agile Operations Roadmap 






















































































































Assuring Effective Missions 

Objectives /Accomplishments / Challenges 


Objectives: 

• Cyber Mission Control: Develop tools and 
techniques that enable efficient models of cyber 
operational behaviors (cyber and kinetic) to 
determine the correct course of action in the cyber 
domain 

• Scalable Operations: Develop ability to operate 
and survive during operations conducted by large- 
scale threats 


Accomplishments : 

• Promised last year for FY13 

- OSD: Purple Musket 

- Navy: Flying Squirrel BT Integration 

• FY13/14 AF: Mission Aware Cyber C2 (MACC2) 



Technical Challenges : 

• Tools for mapping and real-time analysis of 
missions to enable cyber/kinetic situational 
awareness 

• Understanding dynamically evolving missions and 
their dependencies, identifying cyber/kinetic 
change indicators, updating models and resolving 
cross-dependencies, projecting change trends 

• Decision Support and reasoning tools that factor in 
multiple dimensions (e.g., attribution, severity, 
reversibility of effect, BDA, ...) 
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Assuring Effective Missions Roadmap 
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Modeling, Simulation, & Experimentation 

Objectives /Accomplishments / Challenges 


Objectives: 

• Simulation and Experimentation Technology: 

- Enable robust, quantifiable, and repeatable 
assessment and validation of candidate cyber 
technology 

• Models & Analysis: 

- Simulate the cyber operational environment with 
high fidelity 

- Describe and predict interactions and effect 
between physical and cyber domains 


Modeling & Simulation 



Accomplishments: 

• Sequoia HPC achieved world record 10 15 events/sec 

• Army: Cyber Army Modeling & Simulation (CyAMS) 

• AF: Cyber Experimentation Environment 


Technical Challenges : 

• Automated, rapid instantiation of large-scale, 
complex computing and network environments 

• Objective architecture for heterogeneous range 
component integration and synchronization 

• M&S for large-scale aggregate Internet behavior, 
operating at multiple timescales 

• Integrated high-fidelity models of kinetic and cyber 
phenomena 

• Human behavioral and intention models 

• Planning and Assessment algorithms to evaluate 
operational agility and assurance 
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Modeling, Simulation, and Experimentation 

(MSE) Roadmap 






































































































Embedded, Mobile, and Tactical 

Objectives /Accomplishments / Challenges 


Objectives: 

• Mobile and Tactical Systems Security 

- Secure information sharing at tactical edge 

- Reduction of mobile computing attack surface in 
all its aspects 

• Embedded Tactical Composite Trust 

- Architectural approaches for composing 
embedded systems 

- Security capabilities needed for robust and 
secure composed systems 

• Leverage International Partners 

Accomplishments : 

• Navy: Network Pump - II 

• Army: Tactical Army Cross Domain Information 

Sharing (TACDIS) 



Apply the Cyber S&T Roadmap to 
Embedded, Mobile, and Tactical Environments 


Technical Challenges : 

• Secure, LPI/J, energy-efficient, mobile 
communication protocols 

• Certifiable, agile, and affordable mobile device 
hardware, OS, and app ecosystem 

• Tools to monitor and assess assurance of cyber 
operations in converged strategic/tactical systems 

• Self-monitoring systems in systems, including real¬ 
time integrity measurement 

• Tools to monitor and assess the health and behaviors 
of embedded cyber systems - security of weapons 
systems and platforms 
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Embedded, Mobile and Tactical Roadmap 
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• BLUF 

• Cyber COI Overview 

• Roadmap Development Process 

• Cyber COI “4 + 2” S&T Roadmaps and Recent 
Successes 

• Hard Problems and Gaps 

• Engagements, Way Ahead, and Opportunities 

• Summary 
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Specific Gap Assessment 


Defense 

• Trustworthy embedded system architectures 
composed of components of mixed trust 

• Trust scoring mechanisms 

• Scalable HW/SW analysis and verification 
techniques 

• Resilient mobility 
Engagement 

• Control planes for heterogeneous 
components and systems 

• Threat-aware defenses 

• Real-time defensive traffic management 

Situational Awareness and Courses of Action 

• Graded options responsive to commander’s 
intent 

• Analysis of Mission Dependencies to Cyber 
Infrastructure 

• Cyber-Kinetic integration, planning, and 
assessment 


Defense Engagement 

Reduce attack surface and 

increase resiliency of DODIN Active defense 

Reduce attack surface and 
increase resiliency of 

embedded/weapons systems Respond to large-scale threats 

Discover, understand, and 
engage threats 


Situational Awareness and Courses of Action 


Understand cyber 
dependencies of 
missions 


Integrated course of 
action, cyber and non- 
cyber 

S_ 


Cyberspace situational 
awareness 


Measurement and Metrics 

a Quantifiable attack surface 
measurement 

• Component and system 
resiliency metrics 

• Threat-based agility metrics 

• Calculus for Mission Assurance 

• Cyber modeling and simulation 
and experimentation 
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Outline 


• BLUF 

• Cyber COI Overview 

• Roadmap Development Process 

• Cyber COI “4 + 2” S&T Roadmaps and Recent 
Successes 

• Hard Problems and Gaps 

• Engagements, Way Ahead, and Opportunities 

• Summary 
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Community Engagement 


• TTCP Cyber Grand Challenge (Kickoff Jun 2014) 

- Trust Foundations 

- Mission Assurance Through Mission Awareness (MASA) 

- Integrated Cyber-EW Operations 

• STRATCOM/J8 EW-Cyber ICD (Draft Dec 2014) 

• Five RDA-TFs for Cyber 

• DoD Innovation Marketplace 

- Bi-Weekly engagement 

- AFRL IR&D Review 


Terms: 

ICD: Initial Capabilities Document 

RDA-TF: Research, Development, & Acquisition Task Force 
TTCP: The Technical Cooperation Panel 
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DoD Unique Cyber Capabilities 



• Experimentation/Assessment 

- Cyber Experimentation Environment 
(CEE) 

- Army Cyber Research & Analytics 
Laboratory (ACAL) 

- D-Shell 

- High Performance Computing (HPC) 

- CND data sets 

• Telecommunications/Wireless 

- Telecommunications Labs (CERDEC) 

- Communications System Integration 
Laboratory (CSIL) 

- HI-FI Advance Waveform and Cyber 
laboratory 

- Electromagnetic Environment (EME) 


* Ranges 

- National Cyber Range (NCR) 

- Joint 10 Range (JIOR) 

• Maturing Capabilities 

- Contested Cyber Environment (CCE) 

- Network Integration Environment (NIE) 
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DoD Cyber Transition to Practice (CTP) 

Initiative 


Emerging "Best of Breed" S&T Matured through Cyber Range-based T&E, 

Demonstrations, and Operational Pilots 



• CTP is maturing and transitioning 
DoD-funded cyber S&T 

- Get S&T addressing key gaps into Ops 

- White House priority 

- Increase TRL, reduce risk 

• CTP emphasizes: 

- Rapid results near term 

- Committed transition partner(s) 

- Co-funding by transition partner(s) 


• FY14 funding: $4.2M 

• Two white paper rounds so far 

- Phase 1: DoD Labs, DARPA, NSA 

- Phase 2: UARCs, FFRDCs, SPAWAR 

• 8 projects underway 

• Future 

- Planning currently underway for next phase 
of CTP 
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Industry Engagement - Way Ahead 


• Strategic DoD-Industrial cooperation in security 
marketplace 

- Metrics development 

- Standards bodies participation/voting 

- Army: Cooperative development model with industry 

- Intellectual Property business cases that reduce market friction 

• DoD-Industrial Collaboration and Co-Development 

- Personnel Exchanges 

- Cooperative R&D Agreements (CRADA) 

- Experimentation, T&E Ranges 

• Increase speed of cyber acquisition 

- Enhanced M&S for early assessment of S&T candidates 

- Rapid-response S&T development 

- Examples: DARPA Cyber Fast Track, AFRL ACT IDIQ...other Services also 
exploring similar vehicles 

• OTHER IDEAS? 
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Defense Innovation Marketplace 

Resources For Industry And DoD 


DEFENSE INNOVATION MARKETPLACE 
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CONNECTING INDUSTRY & DoD 

Th« Defense Innovation Marketplace is a centralized resource 
to reinvigorate innovation. 
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Improve 

Industry 
understanding 
of DoD needs 



Marketplace: Resources for DoD 

• Secure portal with 10,000+ IR&D 
Project Summaries 

• Access for DoD S&T/ R&D and 
Acquisition Professionals 

• DoD Searchers encouraged to contact 
the Industry POC listed on project 
summaries of interest 


Marketplace: Resources for Industry 

• DoD R&D Roadmaps; Investment 
Strategy 

• Business Opportunities with the DoD 

• Virtual Interchanges & Events 

• Secure Portal for IR&D Project 
Summaries 

• Top Downloads/Pages visited 

• DoD IR&D SEARCH Trends 


www.DefenselnnovationMarketplace.mil 
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Additional Resources 



• DIA Needipedia (http://www.dia.mil/Business/Needipedia.aspx) 

- Provides a direct channel of Defense Intelligence Agency (DIA) needs into the emerging technology 
community 

• FedBizOps (https://www.fbo.gov/) 

- Portal into government acquisitions providing a centralized repository for federal contract 
opportunities. 

• SBIR Announcements (http://www.dodsbir.net) 

- Resource center for DoD SBIR 

• For more information on DoD cyber Science & Technology news, research needs and engagement 
opportunities, visit: 

- Army Research Office (ARO)/Army Research Lab (ARL) (http://www.arl.army.mil) 

- Office of Naval Research (ONR) (http://www.onr.navy.mil) 

- Naval Research Laboratory (NRL) (http://www.nrl.navy.mil) 

- Air Force Office of Scientific Research (AFOSR) (http://www.afosr.af.mil) 

- Defense Advanced Research Projects Agency (DARPA) (http://www.darpa.mil) 
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Contacts 



• SG Lead: Dr Richard W. Linderman 

- Cyber COI Steering Group Chair 

- AFRL/RI Chief Scientist 

- (315)330-4512 

- Richard.Linderman@us.af.mil 

• WG Lead: Mr. Chester Maciag 

- Cyber COI WG Chair 

- AFRL/RI Principal Cyber S&T Strategist 

- (315)330-2560 

- Chester.Maciag@us.af.mil 


• OSD SG Rep: Dr Steven King 

— OSD SG Rep 

- OASD(R&E) Deputy Director Cyber Technologies 

- (571)372-6710 

- Steven.E.King.50.civ@mail.mil 

• Army SG Rep: Mr. Henry Muller 

- CERDEC Acting Director 

- POC: Mr. Giorgio Bertoli 

- (443)861-0743 

- Giorgio.Bertoli.civ@mail.mil 

• Navy SG Rep: Dr. Wen Masters 

- Office of Naval Research 

- POC: Dr. Gary Toth 

- (703) 696-4961 

- Gary.Toth@navy.mil 

• NSA SG Rep: Dr. Boyd Livingston 

- NSA/R Chief Scientist for Research 

- POC: Dr. Grant Wagner 

- (443) 634-4200 

- gmw@tycho.nsa.mil 


Cyber Col 
14-Nov-14 Page-38 


Distribution A - For Public Release 

























Summary 


• Established, mature, and coordinated community 

* Cyber S&T aligned to expanding operational 
capability gaps/priorities 

* Cyber S&T contributions to nearly all Seven DoD 
Hard Problems 

• Driving deeper engagement with industry and 
international partners 
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DoD Cyber Ecosystem 
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